lint: Extend valid-pipeline-git-checkout-tag to account for branch

When using `git-checkout`, it's valid to specify either `tag` or
`branch`.  Currently we only check if `tag` exists, and if it doesn't
then packages need ignore the lint error.  Let's extend the check to
account for `branch` as well.

It's important to say that `tag` and `branch` are mutually exclusive,
but the test is not checking for that because the pipeline itself does
it.

Signed-off-by: Sergio Durigan Junior <sergiodj@chainguard.dev>

Author: sergiodj

pkg/lint/rules.go

@@ -353,14 +353,17 @@ var AllRules = func(l *Linter) Rules { //nolint:gocyclo
 			},
 		},
 		{
-			Name:        "valid-pipeline-git-checkout-tag",
-			Description: "every git-checkout pipeline should have a tag",
+			Name:        "valid-pipeline-git-checkout-tag-or-branch",
+			Description: "every git-checkout pipeline should have a tag or branch",
 			Severity:    SeverityError,
 			LintFunc: func(config config.Configuration) error {
 				for _, p := range config.Pipeline {
 					if p.Uses == gitCheckout {
-						if _, ok := p.With["tag"]; !ok {
-							return fmt.Errorf("tag is missing")
+						_, hasTag := p.With["tag"]
+						_, hasBranch := p.With["branch"]
+						// "branch" and "tag" are mutually exclusive
+						if !hasTag && !hasBranch {
+							return fmt.Errorf("tag or branch is missing")
 						}
 					}
 				}

pkg/lint/rules_test.go

@@ -312,17 +312,17 @@ func TestLinter_Rules(t *testing.T) {
 			matches: 1,
 		},
 		{
-			file:        "wrong-pipeline-git-checkout-tag.yaml",
+			file:        "wrong-pipeline-git-checkout-tag-or-branch.yaml",
 			minSeverity: SeverityWarning,
 			want: EvalResult{
-				File: "wrong-pipeline-git-checkout-tag",
+				File: "wrong-pipeline-git-checkout-tag-or-branch",
 				Errors: EvalRuleErrors{
 					{
 						Rule: Rule{
-							Name:     "valid-pipeline-git-checkout-tag",
+							Name:     "valid-pipeline-git-checkout-tag-or-branch",
 							Severity: SeverityError,
 						},
-						Error: fmt.Errorf("[valid-pipeline-git-checkout-tag]: tag is missing (ERROR)"),
+						Error: fmt.Errorf("[valid-pipeline-git-checkout-tag-or-branch]: tag or branch is missing (ERROR)"),
 					},
 				},
 			},

…les/wrong-pipeline-git-checkout-tag.yaml …pipeline-git-checkout-tag-or-branch.yamlpkg/lint/testdata/files/wrong-pipeline-git-checkout-tag.yaml renamed to pkg/lint/testdata/files/wrong-pipeline-git-checkout-tag-or-branch.yaml pkg/lint/testdata/files/wrong-pipeline-git-checkout-tag.yaml renamed to pkg/lint/testdata/files/wrong-pipeline-git-checkout-tag-or-branch.yaml

@@ -1,8 +1,8 @@
 package:
-  name: wrong-pipeline-git-checkout-tag
+  name: wrong-pipeline-git-checkout-tag-or-branch
   version: 1.0.0
   epoch: 0
-  description: "a package with missing pipeline git-checkout tag"
+  description: "a package with missing pipeline git-checkout tag or branch"
   copyright:
     - paths:
         - "*"
@@ -13,7 +13,6 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://test.com/missing-copyright/${{package.version}}.tar.gz
-      branch: main
       expected-commit: 9c5cfe0525dc7415cec482342ca674875c1e9115
 update:
   enabled: true